Splunk SOAR

How can I run on_poll Ingest Action in SOAR app on a schedule?

anniefry
Engager

I am trying to figure out how to get the on-poll action to run outside of a playbook  to be scheduled in the asset settings under the "ingest setting" tab -- in SOAR on the app page, the ingest setting tab isn't showing up even though I've written an on_poll action within my code. I can run the on_poll action from the app page, but I'm not sure how to run it on a schedule.

Labels (1)
0 Karma
1 Solution

ccl0utier
Splunk Employee
Splunk Employee

Hi @anniefry,

I tested this in my own home lab instance and did a bit of research internally.  The App Wizard apparently does not support adding an on poll action at the moment.  I've asked our documentation team to indicate that in our documentation.

Your best bet is to clone an existing app (say the Splunk or Timer ones) and then use the on poll action that is cloned to create your customized one.

Hope that helps.

View solution in original post

saraomd93
Path Finder

Hi friends.
I’m still facing the same issue in version 6.3.1.178 in 2025. The action type ingest has been removed from the list of available app types, and even if you implement the "on_poll" method, the Ingest Settings tab will not appear in the app

SK

0 Karma

anniefry
Engager

Thank you, as this did help. I used the Timer existing app, within the wizard after choosing a custom action to add for a framework of how to add the action. Then I looked at the json for the existing timer app and thoughtfully borrowed the action entry for on_poll. It's working now.

0 Karma

ccl0utier
Splunk Employee
Splunk Employee

Hi @anniefry,

I tested this in my own home lab instance and did a bit of research internally.  The App Wizard apparently does not support adding an on poll action at the moment.  I've asked our documentation team to indicate that in our documentation.

Your best bet is to clone an existing app (say the Splunk or Timer ones) and then use the on poll action that is cloned to create your customized one.

Hope that helps.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...